ScreenShot
| Created | 2021.09.08 09:44 | Machine | s1_win7_x6402 |
| Filename | rollerkind.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 31 detected (AIDetect, malware2, malicious, high confidence, Johnnie, Stop, Artemis, Unsafe, Kryptik, Eldorado, Attribute, HighConfidence, Generic@ML, RDML, VRNCGo3rU, CydH6SGKxc7w, susgen, ai score=85, StopCrypt, score, BScope, Chapak, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | 39c975f6377274ff7240746aa53ad1a6 | ||
| sha256 | ce2a29c9faa35890f4d01da7c47838173c09a4a93cd910aec1e29b5b35cc6f87 | ||
| ssdeep | 12288:Q1tgEnU36a+C2AejPTtYjVUIxxjdqHbfyMRzdrH7YVNY6buyVWjSYA:QfUK7ntgxjdqHrpRxrHKNYtyVWjSL | ||
| imphash | 9325a2124ce99db4bd879a17d27ac59b | ||
| impfuzzy | 48:9NDmYODtSUdLXD63J8XuFJO5+fc1tHaEGVUSc6ixEvB:9t0EELXDcJ8XAJ0+fc1t6EGVUScLx0 | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 31 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 DosDateTimeToFileTime
0x41e004 FindFirstChangeNotificationW
0x41e008 lstrlenA
0x41e00c CopyFileExW
0x41e010 SetLocalTime
0x41e014 GetCPInfo
0x41e018 HeapAlloc
0x41e01c InterlockedIncrement
0x41e020 GetQueuedCompletionStatus
0x41e024 ReadConsoleA
0x41e028 InterlockedDecrement
0x41e02c GlobalSize
0x41e030 GetNamedPipeHandleStateA
0x41e034 CreateDirectoryW
0x41e038 GlobalLock
0x41e03c GetModuleHandleW
0x41e040 GetTickCount
0x41e044 GetCurrentThread
0x41e048 GetSystemTimeAsFileTime
0x41e04c GetPrivateProfileStringW
0x41e050 SetCommState
0x41e054 GetCommandLineA
0x41e058 TlsSetValue
0x41e05c GetPrivateProfileIntA
0x41e060 GetVolumeInformationA
0x41e064 LoadLibraryW
0x41e068 GetSystemWindowsDirectoryA
0x41e06c GetConsoleAliasExesLengthW
0x41e070 GetVersionExW
0x41e074 IsProcessorFeaturePresent
0x41e078 TerminateProcess
0x41e07c LCMapStringA
0x41e080 GetPrivateProfileIntW
0x41e084 InterlockedExchange
0x41e088 GetStartupInfoA
0x41e08c SetThreadLocale
0x41e090 GetCPInfoExW
0x41e094 GetLastError
0x41e098 GetProcAddress
0x41e09c SetFirmwareEnvironmentVariableW
0x41e0a0 SetStdHandle
0x41e0a4 DisableThreadLibraryCalls
0x41e0a8 LoadLibraryA
0x41e0ac Process32FirstW
0x41e0b0 LocalAlloc
0x41e0b4 GetFileType
0x41e0b8 WritePrivateProfileStringA
0x41e0bc SetCurrentDirectoryW
0x41e0c0 SetThreadIdealProcessor
0x41e0c4 SetEnvironmentVariableA
0x41e0c8 GetThreadPriority
0x41e0cc QueryMemoryResourceNotification
0x41e0d0 HeapSetInformation
0x41e0d4 FreeEnvironmentStringsW
0x41e0d8 EnumResourceNamesA
0x41e0dc GetStringTypeW
0x41e0e0 RequestWakeupLatency
0x41e0e4 FindAtomW
0x41e0e8 ReadConsoleOutputCharacterW
0x41e0ec GetProfileSectionW
0x41e0f0 DeleteFileA
0x41e0f4 Sleep
0x41e0f8 InitializeCriticalSection
0x41e0fc DeleteCriticalSection
0x41e100 EnterCriticalSection
0x41e104 LeaveCriticalSection
0x41e108 GetStartupInfoW
0x41e10c UnhandledExceptionFilter
0x41e110 SetUnhandledExceptionFilter
0x41e114 GetModuleFileNameW
0x41e118 HeapValidate
0x41e11c IsBadReadPtr
0x41e120 RaiseException
0x41e124 RtlUnwind
0x41e128 GetCurrentProcess
0x41e12c IsDebuggerPresent
0x41e130 TlsGetValue
0x41e134 TlsAlloc
0x41e138 GetCurrentThreadId
0x41e13c TlsFree
0x41e140 SetLastError
0x41e144 QueryPerformanceCounter
0x41e148 GetCurrentProcessId
0x41e14c ExitProcess
0x41e150 GetEnvironmentStringsW
0x41e154 GetCommandLineW
0x41e158 SetHandleCount
0x41e15c GetStdHandle
0x41e160 HeapDestroy
0x41e164 HeapCreate
0x41e168 HeapFree
0x41e16c VirtualFree
0x41e170 GetModuleFileNameA
0x41e174 WriteFile
0x41e178 FlushFileBuffers
0x41e17c WideCharToMultiByte
0x41e180 GetConsoleCP
0x41e184 GetConsoleMode
0x41e188 DebugBreak
0x41e18c OutputDebugStringA
0x41e190 WriteConsoleW
0x41e194 OutputDebugStringW
0x41e198 HeapSize
0x41e19c HeapReAlloc
0x41e1a0 VirtualAlloc
0x41e1a4 GetACP
0x41e1a8 GetOEMCP
0x41e1ac IsValidCodePage
0x41e1b0 InitializeCriticalSectionAndSpinCount
0x41e1b4 WriteConsoleA
0x41e1b8 GetConsoleOutputCP
0x41e1bc MultiByteToWideChar
0x41e1c0 SetFilePointer
0x41e1c4 LCMapStringW
0x41e1c8 GetStringTypeA
0x41e1cc GetLocaleInfoA
0x41e1d0 CloseHandle
0x41e1d4 CreateFileA
USER32.dll
0x41e1e4 GetComboBoxInfo
MSIMG32.dll
0x41e1dc AlphaBlend
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 DosDateTimeToFileTime
0x41e004 FindFirstChangeNotificationW
0x41e008 lstrlenA
0x41e00c CopyFileExW
0x41e010 SetLocalTime
0x41e014 GetCPInfo
0x41e018 HeapAlloc
0x41e01c InterlockedIncrement
0x41e020 GetQueuedCompletionStatus
0x41e024 ReadConsoleA
0x41e028 InterlockedDecrement
0x41e02c GlobalSize
0x41e030 GetNamedPipeHandleStateA
0x41e034 CreateDirectoryW
0x41e038 GlobalLock
0x41e03c GetModuleHandleW
0x41e040 GetTickCount
0x41e044 GetCurrentThread
0x41e048 GetSystemTimeAsFileTime
0x41e04c GetPrivateProfileStringW
0x41e050 SetCommState
0x41e054 GetCommandLineA
0x41e058 TlsSetValue
0x41e05c GetPrivateProfileIntA
0x41e060 GetVolumeInformationA
0x41e064 LoadLibraryW
0x41e068 GetSystemWindowsDirectoryA
0x41e06c GetConsoleAliasExesLengthW
0x41e070 GetVersionExW
0x41e074 IsProcessorFeaturePresent
0x41e078 TerminateProcess
0x41e07c LCMapStringA
0x41e080 GetPrivateProfileIntW
0x41e084 InterlockedExchange
0x41e088 GetStartupInfoA
0x41e08c SetThreadLocale
0x41e090 GetCPInfoExW
0x41e094 GetLastError
0x41e098 GetProcAddress
0x41e09c SetFirmwareEnvironmentVariableW
0x41e0a0 SetStdHandle
0x41e0a4 DisableThreadLibraryCalls
0x41e0a8 LoadLibraryA
0x41e0ac Process32FirstW
0x41e0b0 LocalAlloc
0x41e0b4 GetFileType
0x41e0b8 WritePrivateProfileStringA
0x41e0bc SetCurrentDirectoryW
0x41e0c0 SetThreadIdealProcessor
0x41e0c4 SetEnvironmentVariableA
0x41e0c8 GetThreadPriority
0x41e0cc QueryMemoryResourceNotification
0x41e0d0 HeapSetInformation
0x41e0d4 FreeEnvironmentStringsW
0x41e0d8 EnumResourceNamesA
0x41e0dc GetStringTypeW
0x41e0e0 RequestWakeupLatency
0x41e0e4 FindAtomW
0x41e0e8 ReadConsoleOutputCharacterW
0x41e0ec GetProfileSectionW
0x41e0f0 DeleteFileA
0x41e0f4 Sleep
0x41e0f8 InitializeCriticalSection
0x41e0fc DeleteCriticalSection
0x41e100 EnterCriticalSection
0x41e104 LeaveCriticalSection
0x41e108 GetStartupInfoW
0x41e10c UnhandledExceptionFilter
0x41e110 SetUnhandledExceptionFilter
0x41e114 GetModuleFileNameW
0x41e118 HeapValidate
0x41e11c IsBadReadPtr
0x41e120 RaiseException
0x41e124 RtlUnwind
0x41e128 GetCurrentProcess
0x41e12c IsDebuggerPresent
0x41e130 TlsGetValue
0x41e134 TlsAlloc
0x41e138 GetCurrentThreadId
0x41e13c TlsFree
0x41e140 SetLastError
0x41e144 QueryPerformanceCounter
0x41e148 GetCurrentProcessId
0x41e14c ExitProcess
0x41e150 GetEnvironmentStringsW
0x41e154 GetCommandLineW
0x41e158 SetHandleCount
0x41e15c GetStdHandle
0x41e160 HeapDestroy
0x41e164 HeapCreate
0x41e168 HeapFree
0x41e16c VirtualFree
0x41e170 GetModuleFileNameA
0x41e174 WriteFile
0x41e178 FlushFileBuffers
0x41e17c WideCharToMultiByte
0x41e180 GetConsoleCP
0x41e184 GetConsoleMode
0x41e188 DebugBreak
0x41e18c OutputDebugStringA
0x41e190 WriteConsoleW
0x41e194 OutputDebugStringW
0x41e198 HeapSize
0x41e19c HeapReAlloc
0x41e1a0 VirtualAlloc
0x41e1a4 GetACP
0x41e1a8 GetOEMCP
0x41e1ac IsValidCodePage
0x41e1b0 InitializeCriticalSectionAndSpinCount
0x41e1b4 WriteConsoleA
0x41e1b8 GetConsoleOutputCP
0x41e1bc MultiByteToWideChar
0x41e1c0 SetFilePointer
0x41e1c4 LCMapStringW
0x41e1c8 GetStringTypeA
0x41e1cc GetLocaleInfoA
0x41e1d0 CloseHandle
0x41e1d4 CreateFileA
USER32.dll
0x41e1e4 GetComboBoxInfo
MSIMG32.dll
0x41e1dc AlphaBlend
EAT(Export Address Table) is none